Legal & Privacy

TERMS OF SERVICE Last Updated: 18 October 2026 Effective Date: 1 August 2026

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1. AGREEMENT TO TERMS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

By accessing or using the Flowen Platform (flowen.digital and associated subdomains), creating an account, or purchasing a subscription, you ("User", "you") agree to be bound by these Terms of Service ("Terms") and our Privacy Policy. These Terms constitute a legally binding agreement between you and Flowen Speech Technologies Ltd (company number 17470700), part of the Flowen group of companies ("Flowen", "we", "us"). Flowen Speech Technologies Ltd is a wholly owned subsidiary of Flowen Group Limited (company number 17452036).

If you are accessing the Platform on behalf of an organisation (e.g., an NHS trust, private clinic, or educational institution), you represent and warrant that you have authority to bind that organisation and that these Terms apply to that organisation.

If you do not agree to these Terms, you must not access or use the Platform.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2. NATURE OF SERVICE & MEDICAL DISCLAIMER ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

WHAT FLOWEN IS Flowen is an AI-assisted speech fluency practice platform designed to support people who stammer in practising evidence-based speech management techniques, including diaphragmatic breathing, easy onset, light articulatory contacts, pausing, and phrasing. The Platform provides real-time biofeedback, structured practice programmes, and — where applicable — clinical oversight from assigned Speech & Language Pathologists (SLPs).

IMPORTANT MEDICAL DISCLAIMER Flowen is designed as a speech practice tool. It is not intended to diagnose, treat or cure any condition. Flowen does not provide medical diagnosis, clinical treatment, or licensed speech-language pathology services directly. The automated analysis and programme recommendations on the Platform are supportive tools and must not be relied upon as a substitute for professional clinical assessment.

If you have been assigned a clinical SLP through the Platform, your treatment relationship is with that clinician, not with Flowen Speech Technologies Ltd. Flowen provides the technical infrastructure for their clinical practice.

Always seek the advice of a qualified healthcare professional with any questions you may have regarding your health condition. Never disregard professional medical advice or delay seeking it because of content you have read on or received through the Platform.

Individual results vary. Flowen makes no guarantee of fluency improvement, symptom reduction, or any particular therapeutic outcome.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3. ELIGIBILITY & ACCOUNT REGISTRATION ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

You must be at least 16 years of age to use the Platform. By registering, you confirm you are at least 16. Users between 16 and 18 must have parental or guardian consent.

You must provide accurate, current, and complete registration information. You are responsible for maintaining the confidentiality of your account credentials and for all activity under your account. You must notify us immediately at hello@flowen.digital if you suspect unauthorised access to your account.

You may not create an account on behalf of another person without their explicit consent. You may not transfer your account to any other party.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 4. SUBSCRIPTIONS & PAYMENT TERMS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SUBSCRIPTION PLANS We offer subscription-based access to the Platform. Current plans and pricing are displayed at flowen.digital. Prices are in GBP and inclusive of any applicable VAT.

BILLING Subscriptions are billed on a recurring basis (monthly or annually as selected). Payment is processed by Stripe, Inc., our authorised payment processor. By subscribing, you authorise Stripe to charge your payment method on each billing cycle.

FREE TRIALS & CARD-AT-SIGNUP Some new registrations are offered a 7-day free trial. Where a trial is offered, we may ask you to save a payment method at registration (via Stripe's secure setup flow) so your subscription can continue without interruption when the trial ends. Key points:

— No charge is taken when you save your card or during the trial. — The exact date of your first charge is shown before you save your card, confirmed by email when the trial starts, and reminded about approximately 24 hours before the first charge. — Unless you cancel before the trial ends, the saved payment method is charged the displayed subscription price on the first day after the trial, and your subscription renews on the normal billing cycle from that date. — You can cancel at any time during the trial in one click from your Billing page. If you cancel before the trial ends, no charge is taken and you keep access until the trial end date. — One free trial per person. — Nothing in this trial offer limits your statutory rights, including the 14-day cooling-off rights described under REFUNDS below.

FOUNDING MEMBER PRE-ORDERS Founding Member pre-launch seats are offered at a preferential rate locked for your first 12 months of subscription. Pre-launch pre-payments (made before the Platform's general availability date) are fully refundable on request at any time prior to your first active subscription period commencing. After that, standard terms apply.

CANCELLATION You may cancel your subscription at any time via your account settings or by emailing hello@flowen.digital. Cancellation takes effect at the end of your current billing period. You retain access until that date. No partial refunds are issued for mid-period cancellations, except as required by consumer law or expressly stated in a promotional offer.

REFUNDS Where you have statutory cancellation rights under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 (14-day cooling-off period for digital services), we will honour these in full. Refund requests within this period should be sent to hello@flowen.digital with your order reference.

PRICE CHANGES We will give at least 30 days' written notice of any price increases. You may cancel within this notice period without penalty if you do not wish to continue at the new price.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 5. CLINICIAN ACCOUNTS & NHS/INSTITUTIONAL USE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Speech & Language Pathologists and other clinical professionals ("Clinicians") who use the Platform to support patients:

— Must hold, and confirm that they hold, current registration with the Health and Care Professions Council (HCPC) or equivalent regulatory body, and maintain that registration throughout their use of the Platform. — Are responsible for their own clinical decision-making. Flowen provides a platform; it does not supervise or direct clinical practice. — Must obtain appropriate patient consent before assigning patients and accessing clinical data. — Must comply with their employer's and regulatory body's data protection, clinical governance, and confidentiality obligations. — Are responsible for maintaining appropriate professional indemnity insurance.

Where the Platform is accessed under an institutional or NHS contract, the contracting organisation is responsible for ensuring all authorised users comply with these Terms and any applicable Data Processing Agreement.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 6. ACCEPTABLE USE & PROHIBITED CONDUCT ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

You agree not to:

— Use the Platform for any unlawful purpose or in violation of any applicable laws or regulations — Attempt to gain unauthorised access to any part of the Platform, other user accounts, or our backend systems — Submit false, misleading, or fraudulent information during registration or use — Use automated scripts, bots, or scrapers to access the Platform without authorisation — Reverse-engineer, decompile, or attempt to extract the source code of any part of the Platform — Reproduce, distribute, or commercially exploit any Platform content without our prior written consent — Transmit any malware, viruses, or other harmful code — Use the Platform to harass, intimidate, or harm any other user — Circumvent any access controls, rate limits, or technical restrictions — Resell or sublicense access to the Platform without our written authorisation

Violation of this section may result in immediate account suspension and legal action.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 7. INTELLECTUAL PROPERTY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

All software, algorithms, machine learning models, user interface designs, visual elements (including the Flowen dual-waveform logomark), text content, audio processing methods, and documentation are the exclusive intellectual property of Flowen IP Ltd (company number 17471287) or its licensors, protected by copyright, trade mark, and other applicable laws. Flowen Speech Technologies Ltd operates the Platform under licence from Flowen IP Ltd.

We grant you a limited, non-exclusive, non-transferable, revocable licence to access and use the Platform for your personal or professional therapeutic purposes in accordance with these Terms. This licence does not include any right to copy, modify, distribute, sell, or create derivative works of any Platform content.

Your account data and session data remain yours. You grant us a limited licence to process this data for the purposes set out in our Privacy Policy.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 8. THIRD-PARTY SERVICES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

The Platform integrates with third-party services including Stripe (payment processing), Supabase (database infrastructure) and the other providers listed in our Privacy Policy. Your use of these services may be subject to their own terms of service and privacy policies. We are not responsible for the acts or omissions of third-party service providers.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 9. DISCLAIMERS & WARRANTIES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

THE PLATFORM IS PROVIDED "AS IS" AND "AS AVAILABLE". TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, FLOWEN SPEECH TECHNOLOGIES LTD EXPRESSLY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING BUT NOT LIMITED TO:

— IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE — WARRANTIES THAT THE PLATFORM WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE FROM HARMFUL COMPONENTS — WARRANTIES REGARDING THE ACCURACY, COMPLETENESS, OR CURRENCY OF ANY CLINICAL RECOMMENDATIONS

This disclaimer does not affect any mandatory statutory rights you may have as a consumer under English law that cannot be excluded.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 10. LIMITATION OF LIABILITY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

TO THE FULLEST EXTENT PERMITTED BY ENGLISH LAW:

(a) FLOWEN SPEECH TECHNOLOGIES LTD SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, LOSS OF PROFITS, LOSS OF DATA, LOSS OF GOODWILL, OR SERVICE INTERRUPTION, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY.

(b) IN NO EVENT SHALL FLOWEN'S TOTAL AGGREGATE LIABILITY TO YOU FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS OR THE PLATFORM EXCEED THE GREATER OF: (i) THE TOTAL AMOUNT PAID BY YOU TO FLOWEN IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE CLAIM; OR (ii) £100.

Nothing in these Terms excludes or limits our liability for death or personal injury caused by negligence, fraudulent misrepresentation, or any other liability that cannot be excluded under English law. Nothing in these Terms limits liability for breach of your statutory consumer rights.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 11. INDEMNIFICATION ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

If you use the Platform on behalf of an organisation, you agree to indemnify, defend, and hold harmless Flowen Speech Technologies Ltd and its officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising out of or in any way connected with: (a) your access to or use of the Platform in violation of these Terms; (b) your breach of any representation or warranty in these Terms; or (c) your violation of any applicable law or the rights of any third party.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 12. TERM, SUSPENSION & TERMINATION ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

These Terms are effective from the date you first access the Platform and remain in effect until terminated.

We may suspend or terminate your account immediately, without prior notice or liability, if you materially breach these Terms, engage in prohibited conduct, or if required to do so by law. On termination, your right to use the Platform ceases and we may delete your account data in accordance with our Privacy Policy.

You may terminate your account at any time by emailing hello@flowen.digital. Sections 7, 10, 11, and 13 survive termination.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 13. GOVERNING LAW & DISPUTE RESOLUTION ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

These Terms are governed by the laws of England and Wales. Any dispute arising out of or in connection with these Terms shall be subject to the exclusive jurisdiction of the courts of England and Wales. Consumer users in Scotland or Northern Ireland retain the right to bring proceedings before the courts of their home jurisdiction.

We are committed to resolving disputes informally. Before commencing legal proceedings, please contact hello@flowen.digital to seek resolution. The informal process is described in our Governing Law & Dispute Resolution page.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 14. CHANGES TO THESE TERMS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

We may revise these Terms from time to time. Material changes will be communicated by email at least 30 days before taking effect. Your continued use of the Platform after the effective date constitutes acceptance. If you do not accept the revised Terms, you should stop using the Platform and cancel your subscription.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 15. CONTACT ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

For questions about these Terms: hello@flowen.digital Flowen Speech Technologies Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

PRIVACY POLICY & UK GDPR STATEMENT Last Updated: 18 October 2026 Effective Date: 1 August 2026

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1. WHO WE ARE AND HOW TO CONTACT US ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Flowen Speech Technologies Ltd (company number 17470700), a company registered in England and Wales, part of the Flowen group of companies ("Flowen", "we", "us", "our"), operates the Flowen speech fluency platform, available at flowen.digital and associated subdomains (the "Platform"). Flowen Speech Technologies Ltd is a wholly owned subsidiary of Flowen Group Limited (company number 17452036).

For the purposes of UK data protection law, Flowen Speech Technologies Ltd is the Data Controller.

Data Protection Contact Email: hello@flowen.digital Write to: Data Protection, Flowen Speech Technologies Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Data (Use and Access) Act 2025.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2. THE PERSONAL DATA WE COLLECT ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

We collect the following categories of personal data:

IDENTITY & ACCOUNT DATA — Full name and chosen display name — Email address — Professional role and organisation (for clinicians) — Account creation date and login history

CLINICAL & HEALTH DATA (Special Category — Article 9 UK GDPR) — Speech fluency metrics: block frequency, blocks per minute (BPM), disfluency pattern data — Acoustic biomarkers: root mean square amplitude (RMS), long-term average spectrum (LTAS), fundamental frequency — Therapy stage progression, session completion records, and programme adherence data — Treatment plans assigned by Speech & Language Pathologists (SLPs), including prescribed stages, session targets, and clinical goals — Self-reported fluency ratings and therapy notes — Audio recordings of practice sessions (see below)

HOW YOUR VOICE AND AUDIO ARE HANDLED Real-time fluency metrics (block detection, RMS, spectral measures) are computed in-browser using the Web Audio API as you practise. Separately from that live analysis, raw audio is also recorded and leaves your device in the following cases:

— Session playback for your SLP: a recording of each practice session is uploaded and stored so your assigned Speech & Language Pathologist can review it. This happens for every session where you have an assigned SLP, under the health/social-care processing basis (Article 9(2)(h)), not separate consent — this is a normal part of clinical review, the same as an SLP reviewing a recording made in an in-person session. — AI conversation practice: if you use the AI conversational practice feature, your live audio is streamed in real time to our voice-infrastructure provider (Agora) and processed by our AI language and speech providers (OpenAI, and ElevenLabs where a personal voice clone is used) to generate the AI's spoken responses. See section 6 for these providers' roles. — Voice cloning (optional): if you choose to create a personal AI voice clone, a short calibration recording is uploaded to ElevenLabs to build it. ElevenLabs retains cloning audio samples and the voice model for this feature. Provider deletion requests, backup retention and legal exceptions are separate from removing a saved voice identifier in Flowen; contact support for confirmation of a deletion request. — Model improvement (optional, separate consent): if you separately opt in to help improve Flowen's AI models, some session recordings are also used for that purpose. This is never on by default and never bundled with any other consent — you can withdraw it at any time without affecting your access to the Platform.

Retention: the default session-recording retention setting is 90 days. Eligible records are considered by the weekly retention job, so deletion is not guaranteed on the exact 90th day. Account-specific settings and legal holds may change the period. This notice is not evidence that a deletion run succeeded; contact us for a deletion request. Separately consented model-improvement contributions have a 12-calendar-month review window. Age-based corpus deletion is gated and is not currently claimed as active. Withdrawal excludes contributions from review; verified storage deletion is a separate process. Practice metadata is distinct from raw audio.

PAYMENT DATA — Subscription status and plan type — Stripe Customer ID (a reference token — we never store full card numbers, CVV codes, or bank account details) — Where a free trial is offered at registration, a Stripe Payment Method reference token saved at signup (card details themselves are entered into and stored by Stripe, never by Flowen) and the fact and status of that save — Trial enrollment state: whether a trial was offered, started, converted, or cancelled, and the associated dates — Payment history and invoice records

COMMUNICATIONS — Messages exchanged between patients and assigned SLPs within the Platform's clinical messaging system — Enquiries submitted via contact forms or email

TECHNICAL & USAGE DATA — IP address and approximate geolocation (country/region) — Browser type, version, and operating system — Device type and screen resolution — Pages visited, features used, and session timestamps — Error logs (with PHI masking applied via Sentry)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3. HOW WE COLLECT YOUR DATA ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

— Directly from you: when you register, complete your profile, undertake practice sessions, or contact us — From your assigned clinician: treatment plans, clinical goals, and session annotations entered by your SLP — Automatically: technical and usage data collected as you use the Platform

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 4. LAWFUL BASES FOR PROCESSING ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

We rely on the following lawful bases under UK GDPR Article 6:

ARTICLE 6(1)(b) — CONTRACTUAL NECESSITY Processing necessary to deliver the Platform services you have subscribed to, including: — Creating and managing your account — Delivering practice sessions, biofeedback, and therapy programmes — Processing subscription payments via Stripe — Providing clinical messaging between patients and SLPs

ARTICLE 6(1)(a) — CONSENT We rely on your freely given, specific, informed, and unambiguous consent for: — Processing of special category health and voice biomarker data (see Article 9 below) — Sending optional marketing communications and product updates You may withdraw any consent at any time without detriment. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

ARTICLE 6(1)(c) — LEGAL OBLIGATION Processing required to comply with our legal obligations, including: — VAT and financial record-keeping under HMRC requirements — Responding to lawful requests from regulatory authorities — Data erasure and subject access requests under UK GDPR

ARTICLE 6(1)(f) — LEGITIMATE INTERESTS Processing necessary for our legitimate interests, where these are not overridden by your rights: — Maintaining platform security and preventing fraud — Improving Platform features through aggregated, anonymised analytics — Defending legal claims

SPECIAL CATEGORY DATA — ARTICLE 9(2)(a) — EXPLICIT CONSENT For speech fluency metrics and acoustic biomarkers (health data under Article 9), we rely on your explicit, affirmative consent obtained at onboarding. This consent is separately obtained, unbundled from other terms, and recorded in our immutable consent audit log with timestamp.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 5. HOW WE USE YOUR DATA ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

PURPOSE | LAWFUL BASIS ——————————————————————————————————————|—————————————————————— Deliver speech practice sessions | Contract (6(1)(b)) Provide real-time biofeedback | Contract + Consent (9(2)(a)) Manage SLP–patient clinical workflow | Contract (6(1)(b)) Process subscription payments | Contract (6(1)(b)) Generate PDF therapy progress reports | Contract (6(1)(b)) Send session reminders | Contract (6(1)(b)) Send service and account emails | Contract (6(1)(b)) Send marketing emails (opt-in only) | Consent (6(1)(a)) Monitor platform security | Legitimate interests (6(1)(f)) Anonymised product analytics | Legitimate interests (6(1)(f)) HMRC compliance and invoicing | Legal obligation (6(1)(c)) Respond to your support queries | Contract (6(1)(b)) Improve our AI models using your session recordings | Consent (9(2)(a)) — separate opt-in, never bundled

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 6. WHO WE SHARE YOUR DATA WITH ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

We do not sell your personal data. We share data only with the following categories of recipients, under appropriate contractual safeguards (Data Processing Agreements):

SUPABASE INC. Role: Sub-processor (database and authentication infrastructure) Data: All Platform data Safeguard: Standard Contractual Clauses (SCCs) with UK Addendum

Cloudflare, Inc. (R2) Role: Sub-processor (object storage for session recordings and consented training contributions where the stored provider is R2) Location and transfer safeguards: must be verified for the enabled deployment and processing schedule. This notice does not certify UK-only storage, processing or access.

VERCEL INC. Role: Sub-processor (cloud hosting and edge functions) Data: Request data, application logs Safeguard: SCCs with UK Addendum

STRIPE INC. Role: Independent data controller (payment processing) Data: Payment data, email for receipt Safeguard: Stripe's own privacy policy governs their processing; they are PCI DSS Level 1 compliant

SENTRY (FUNCTIONAL SOFTWARE INC.) Role: Sub-processor (error monitoring) Data: Error logs, and masked session replays if you choose Accept all Safeguard: SCCs; maskAllText and blockAllMedia enabled

AGORA INC. Role: Sub-processor (real-time voice infrastructure for AI conversation practice) Data: Live audio, streamed in real time — not stored by Agora Safeguard: SCCs with UK Addendum

OPENAI, L.L.C. Role: Sub-processor (AI language model for AI conversation practice) Data: Speech transcribed from your live audio, and text you type or say to the AI Safeguard: SCCs with UK Addendum; OpenAI does not use API data to train its models

ELEVENLABS INC. Role: Sub-processor (AI voice synthesis, and voice cloning if you opt in) Data: Calibration audio samples, derived voice model and identifiers (if you create a voice clone), and text to be spoken by the AI Safeguard: The applicable contract, processing location and transfer safeguards require verification. ElevenLabs retains voice-cloning audio samples; zero-retention guidance excludes Instant Voice Cloning. Provider deletion and backup expiry require confirmation.

YOUR ASSIGNED SLP (if applicable) Role: Independent clinical professional Data: Your session data, fluency metrics, progress reports, and messages Basis: Your consent and the clinical contract between you and your SLP

ANALYTICS AND ADVERTISING PROVIDERS If you enable the relevant optional purposes in our cookie choices, PostHog, Google (Analytics, Tag Manager and Ads), Meta, Snapchat and LinkedIn may receive usage and conversion data. See our Cookie Policy for details and how to withdraw your choice.

LEGAL AUTHORITIES Where required by law, court order, or to protect the rights and safety of our users, we may disclose data to law enforcement or regulatory authorities.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 7. INTERNATIONAL TRANSFERS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Some of our sub-processors process personal data outside the UK. Where any processing involves transfer to a country outside the UK (e.g., sub-processor infrastructure), we ensure an appropriate safeguard is in place: UK adequacy regulations, Standard Contractual Clauses (SCCs) with UK Addendum, or the UK International Data Transfer Agreement (IDTA). Transfers to the US occur only where the recipient participates in the UK–US Data Bridge or equivalent safeguard.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 8. RETENTION PERIODS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

DATA TYPE | RETENTION PERIOD ———————————————————————————————————|———————————————————————————————— Account and profile data | Duration of account + 30 days Raw session audio | Default 90-day setting; weekly eligibility checks, overrides and holds may apply Optional model-improvement corpus | 12-calendar-month review window; automated age-based purge not claimed active Practice session metadata | Duration of account + 90 days Clinical treatment plans | Duration of clinical relationship + 7 years Payment and invoice records | 7 years (HMRC requirement) Consent audit log | For as long as needed to evidence consent Erasure request records | 7 years (legal compliance) Marketing consent records | Until consent withdrawn + 3 years Error logs | 90 days

Following account closure or a valid erasure request, identifiable data is anonymised or deleted within 30 calendar days, except where retention is required by law.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 9. SECURITY MEASURES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

— Overview: We use Supabase authentication, PostgreSQL row-level security, encryption in transit, and access controls limited to what each task needs. This is a description of our controls, not an independent audit or certification. — Row-level security: PostgreSQL RLS enforces strict per-user data isolation — Access controls: Principle of least privilege; service-role access only for privileged server operations — Raw audio: raw audio leaves your device only in the cases described in section 2: SLP session playback, AI conversation practice, optional voice cloning, and optional model improvement. Real-time fluency metrics are computed in your browser.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 10. YOUR RIGHTS UNDER UK GDPR ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

You have the following rights. To exercise any right, contact hello@flowen.digital. We will respond within one calendar month (UK GDPR Article 12). This period may be extended by two months for complex requests; we will notify you.

RIGHT OF ACCESS (Article 15) Request a copy of all personal data we hold about you.

RIGHT TO RECTIFICATION (Article 16) Request correction of inaccurate or incomplete personal data.

RIGHT TO ERASURE (Article 17) Request deletion of your personal data ("right to be forgotten") where: — The data is no longer necessary for the purpose it was collected — You withdraw consent and there is no other lawful basis — You object under Article 21 and we have no overriding legitimate grounds — The data has been unlawfully processed Note: We may retain certain data where required by law (e.g., financial records under HMRC rules).

RIGHT TO RESTRICTION (Article 18) Request that we restrict processing of your data in defined circumstances.

RIGHT TO DATA PORTABILITY (Article 20) Receive your personal data in a structured, commonly used, machine-readable format (CSV/JSON) for data processed by automated means on the basis of consent or contract.

RIGHT TO OBJECT (Article 21) Object to processing based on legitimate interests at any time. We will stop unless we can demonstrate compelling legitimate grounds.

RIGHT TO WITHDRAW CONSENT Where processing is based on consent, you may withdraw at any time via account settings or by contacting us. Withdrawal does not affect prior lawful processing.

RIGHTS RELATING TO AUTOMATED DECISION-MAKING (Article 22) We do not make solely automated decisions with legal or similarly significant effects. Clinical recommendations are advisory and require human clinical oversight.

RIGHT TO LODGE A COMPLAINT You have the right to complain to the Information Commissioner's Office (ICO): Website: ico.org.uk | Phone: 0303 123 1113 | Post: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 11. CHILDREN'S DATA ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

The Platform is for users aged 16 and over. We do not knowingly collect data from anyone under 16. If you believe we have received data from a child under 16, please contact hello@flowen.digital immediately.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 12. UPDATES TO THIS POLICY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

We may update this Privacy Policy periodically. Material changes will be communicated by email to registered users at least 30 days before taking effect. The current version is always available at flowen.digital/legal. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.

CLINICAL SAFETY STATUS The clinical safety documents and hazard log in the repository are controlled drafts. They require professional review, evidence and signed approval before any completed DCB0129 compliance or deployment-readiness claim can be made. This page does not establish a signed Clinical Safety Officer appointment, completed DTAC assessment, DSPT completion or NHS endorsement. For current documentation and enquiries, contact hello@flowen.digital. Flowen is a speech practice tool. It does not replace clinical assessment, diagnosis or care. No therapeutic outcome is guaranteed.

COOKIE POLICY Last Updated: 29 September 2026 Effective Date: 29 September 2026

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1. ABOUT THIS POLICY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

This policy explains how Flowen Speech Technologies Ltd ("Flowen", "we", "us") uses cookies and similar browser technology on flowen.digital. A cookie is a small piece of data stored by your browser. We also use localStorage and sessionStorage for in-browser state. This policy covers our own tools and the advertising and analytics providers that can load after your choice.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2. BEFORE YOU ACCEPT ALL ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Authentication cookies from Supabase keep you signed in. Stripe may use necessary fraud-prevention and payment-flow cookies on checkout pages. The flowen_cookie_consent cookie stores separate analytics, advertising and session-replay choices for one year. A flowen_consent_id is created only when you save a choice, to bind that choice to its server record. It is not used for attribution without advertising consent. Existing binary choices require a new purpose-specific choice. Optional purposes are off until that choice is saved.

Analytics consent is required for __vs visitor counting and server pageviews. Advertising consent is required for __utm campaign parameters, flowen_anon_id attribution, flowen_ref affiliate attribution and incoming advertising click-ID collection. No such identifier is created or attribution collected before the relevant saved choice. Declining or withdrawing deletes the related first-party cookies. A failed save does not enable optional tools.

PostHog and GA4 require Analytics; advertising pixels require Advertising; Sentry Session Replay requires Session replay. GTM can contain mixed-purpose tags and loads only when both Analytics and Advertising are selected. PostHog session recording is disabled. Basic Sentry error capture can run without Session Replay. Browser settings that block necessary cookies may also prevent sign-in.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3. ANALYTICS AFTER ACCEPT ALL ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

PostHog records product usage events and can set ph_* browser identifiers and session cookies. It uses the configured EU endpoint. Google Analytics 4 (GA4), loaded directly or through Google Tag Manager (GTM), measures pageviews and opted-in events and may use Google analytics identifiers. These tools start only after Analytics consent. Sentry Session Replay starts only after Session replay consent; basic error monitoring can run separately without replay.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 4. ADVERTISING AFTER ACCEPT ALL ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Meta Pixel, Snapchat Pixel, LinkedIn Insight Tag, and Google Ads tags (including remarketing through GTM) can run after Advertising consent. These providers may set their own cookies or use comparable browser identifiers to measure visits and conversions across sites. Where enabled, Flowen also sends verified conversion events server-side to Meta, Snapchat or Google Ads; these sends check the latest server consent record. Provider cookie names and retention periods can change under their own policies. No optional advertising script is injected without Advertising consent on a new page load.

We do not sell cookie data to data brokers. This is not a claim that advertising tracking never occurs: it can occur after Advertising consent.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 5. CHANGE YOUR CHOICE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Use the "Change cookie choices" button above to reopen the banner. Choose "Necessary only" to withdraw every optional purpose, or use the separate checkboxes and "Save choices" to change one purpose. The browser choice is stored in flowen_cookie_consent and the new decision is recorded on our server. If scripts had already loaded under an earlier Accept all choice, the page reloads after the withdrawal is recorded so they are no longer running in that tab. You can also clear existing provider cookies in your browser settings. Optional tools start only after the server acknowledges the new purpose-specific decision.

If saving a choice fails, the banner shows an error and does not grant new optional tracking. For questions about first-party visit and attribution data or existing records, contact hello@flowen.digital.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 6. UPDATES AND CONTACT ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

We will update this policy when our cookie practices change. For questions, email hello@flowen.digital or write to Data Protection, Flowen Speech Technologies Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

SAFEGUARDING POLICY Last Updated: 2 October 2026 Effective Date: 26 September 2026

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1. PURPOSE AND SCOPE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Flowen Speech Technologies Ltd operates a digital speech-fluency platform used by people who stutter, including young people aged 16 and over, and by the Speech & Language Pathologists (SLPs) who treat them. This policy sets out how Flowen protects the welfare of children and adults at risk who use the Platform, and what happens when a safeguarding concern arises through it.

This policy applies to all Flowen staff, contractors, and directors with any access to user data or user-facing systems. It does not replace, and is not a substitute for, the safeguarding policy of the clinical organisation employing a user's assigned SLP — that organisation remains responsible for the clinical safeguarding duties owed to its own patients. Flowen's duty under this policy arises from its own, separate position: as the platform provider and data controller, Flowen may become aware of a safeguarding concern (through session content, messages, or a report from a user) that it has a responsibility to act on regardless of what any other organisation does.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 2. LEGAL FRAMEWORK ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

This policy is written with regard to: — Working Together to Safeguard Children 2023 (statutory guidance, England) — The Care Act 2014 (safeguarding adults at risk) — Keeping Children Safe in Education, so far as it informs good practice for any platform used in an educational or NHS-adjacent setting — UK GDPR Article 9(2)(b)/(c) and (h) as the lawful basis for processing special category data where necessary to protect a user's vital interests or for health/social care purposes

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3. DESIGNATED SAFEGUARDING LEAD ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Howard Henry, Sole Director, is Flowen's Designated Safeguarding Lead (DSL) until a dedicated appointment is made as the team grows. The DSL is the first point of contact for any concern raised under this policy and is responsible for deciding whether external referral is required.

Note: the current DSL has not yet completed accredited Level 3 safeguarding training. This is flagged here deliberately rather than left silent — completing that training is a near-term action, not assumed to already be in place.

Contact: hello@flowen.digital, marked "Safeguarding — Urgent" in the subject line.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 4. RECOGNISING A CONCERN ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

A safeguarding concern may come to Flowen's attention through: — Content disclosed in a practice session transcript or clinical message — A direct report from a user, parent/guardian, or clinician — A pattern flagged by an assigned SLP through the Platform's messaging system — Any Flowen staff member noticing something during ordinary use of the admin tools

Categories tracked in Flowen's internal concern log include: a disclosure of harm, an indication of self-harm risk, a situation warranting external referral, or another welfare concern not covered by the above.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 5. WHAT TO DO IF A CONCERN ARISES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. Do not attempt to investigate or question the person concerned. Record what was seen or said, in their own words where possible, without leading questions. 2. Log the concern in Flowen's internal safeguarding record as soon as practicable, and always within 24 hours. 3. Notify the Designated Safeguarding Lead immediately if there is any indication of immediate risk to life or safety — do not wait for the internal log. 4. The DSL will determine whether the concern should be escalated to the user's assigned SLP's own employer, to statutory children's/adult social care services, or to the police, and will make that referral without unnecessary delay. 5. If there is an immediate risk to life, call 999 first, and log/notify afterward.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 6. RECORD-KEEPING ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Every concern is recorded in Flowen's safeguarding concern log (internal, access restricted to admin staff on a need-to-know basis), including: category, description, status, any external escalation, and resolution. This record is retained for the duration of the platform relationship plus 7 years, consistent with the retention period for other clinical records, and is disclosable to statutory authorities on lawful request.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 7. THE AI CONVERSATIONAL PRACTICE FEATURE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

The Platform's AI conversational practice feature is a fluency-practice tool, not a moderated or monitored safeguarding channel, and it is not designed to detect or respond to disclosures of harm. It does not currently screen conversation content for safeguarding indicators in real time. Any disclosure a user makes to the AI feature that later comes to Flowen's attention (for example, through a stored transcript reviewed for another purpose) is handled under section 5 above, the same as a disclosure made anywhere else on the Platform.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 8. TRAINING AND REVIEW ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Any staff or contractors with access to user-facing systems will receive an overview of this policy on onboarding. This policy is reviewed at least annually, or sooner following any safeguarding concern that identifies a gap in it.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 9. CONTACT ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

To raise a safeguarding concern, or for any question about this policy: hello@flowen.digital.

GOVERNING LAW & DISPUTE RESOLUTION Last Updated: 2 October 2026

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ GOVERNING LAW ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

These Terms of Service, Privacy Policy, and all other policies and agreements between you and Flowen Speech Technologies Ltd are governed by, and shall be construed in accordance with, the laws of England and Wales, without regard to conflict of law principles.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ JURISDICTION ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Subject to the provisions below, the courts of England and Wales shall have exclusive jurisdiction to resolve any dispute or claim arising out of or in connection with these agreements or their subject matter or formation (including non-contractual disputes or claims).

Notwithstanding the above: — Consumer users in Scotland may bring proceedings before Scottish courts. — Consumer users in Northern Ireland may bring proceedings before Northern Irish courts. — Nothing in this clause affects your rights to bring proceedings before the courts of another EU/EEA member state if you are habitually resident there and the relevant law requires it.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ INFORMAL DISPUTE RESOLUTION ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Before commencing formal legal proceedings, both parties agree to attempt to resolve any dispute informally. Please email hello@flowen.digital with a description of the dispute and your proposed resolution. We will respond within 14 days. If the dispute is not resolved within 30 days of this notification, either party may proceed to formal dispute resolution.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ CONSUMER STATUTORY RIGHTS ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Nothing in these Terms affects your statutory rights as a consumer under English law, including rights under the Consumer Rights Act 2015, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, and the Consumer Protection from Unfair Trading Regulations 2008.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ CONTACT ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Flowen Speech Technologies Ltd (company number 17470700) 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ hello@flowen.digital flowen.digital